WO2016101591A1

WO2016101591A1 - Packet response method and apparatus

Info

Publication number: WO2016101591A1
Application number: PCT/CN2015/083593
Authority: WO
Inventors: 田旭
Original assignee: 华为技术有限公司
Priority date: 2014-12-22
Filing date: 2015-07-08
Publication date: 2016-06-30
Also published as: CN105791451A; CN105791451B

Abstract

The embodiment of the present invention relates to the technical field of communication and discloses a packet response method and apparatus. The method comprises: an access device receives a target packet sent by a client and obtains and saves a destination Internet Protocol (IP) address of the target packet; the access device processes the target packet to obtain a response packet of the target packet; the access device replaces an original IP address of the response packet with the saved destination IP address of the target packet, and sends the response packet to the client; the access device receives and processes a page acquisition request sent by the client, and returns to the client a page response to the page acquisition request, the page response comprising a uniform resource locator (URL) of a first server. Implementing the present invention obtains a preset URL of the server according to the response packet of the client and enables the client to access websites corresponding to the URL.

Description

Message response method and device

Technical field

The present invention relates to the field of communications technologies, and in particular, to a message response method and apparatus.

Background technique

At present, the Internet has penetrated into all aspects of user life, and users can browse the web through the Internet to obtain various information. When the user accesses the webpage through the client, the client sends a request packet to the web server, where the source Internet Protocol (IP) address of the request packet is the IP address of the client, and the purpose of the request packet is The IP address is the IP address of the website server. When the web server receives the target packet, it returns a response packet of the target packet to the client, where the source IP address of the response packet is the IP address of the remote device, and the destination of the response packet The IP address is the IP address of the client.

Before accessing the Internet, the client needs to access the network through the access device and forward the request packet and the response packet through the access device. However, in actual applications, there may be a communication failure between the access device and the website server, so that the client cannot receive the response message of the target message and cannot access any webpage.

Summary of the invention

The embodiment of the present invention provides a message response method and device, which can obtain a URL of a pre-configured server according to a target message of the client, so that the client accesses the webpage corresponding to the URL, and the client is configured to send the target packet. I can't access any webpage issues afterwards.

In a first aspect, a message response method is provided, including:

The access device receives the target packet sent by the client, and obtains the destination Internet Protocol IP address of the target packet, where the destination packet includes the source IP address, the source port number, and the destination IP address.

The access device processes the target packet to obtain a response packet of the target packet, where the destination IP address and the destination port number of the response packet are the source IP address and the source port of the target packet. number;

The access device replaces the source of the response packet with the saved destination IP address of the target packet Sending the response message to the client by using an IP address;

Receiving, by the access device, a page acquisition request sent by the client, processing the page acquisition request, and returning a page response to the page acquisition request to the client, where the page response includes the first server Uniform Resource Locator URL.

In conjunction with the first aspect, in a first possible implementation of the first aspect,

The access device processes the target packet to obtain the response packet of the target packet, including:

The access device replaces the destination IP address of the target packet with the IP address of the access device, and responds to the target packet to obtain a response packet of the target packet, where the response packet is sent. The IP address is an IP address of the access device;

Correspondingly, the access device receives the page obtaining request sent by the client, and processes the page obtaining request, including:

Receiving, by the access device, a page obtaining request sent by the client, and responding to the page obtaining request, obtaining a page response of the page obtaining request.

In conjunction with the first aspect, in a second possible implementation of the first aspect,

The access device acquires an IP address of the second server;

The access device replaces the destination IP address of the target packet with the IP address of the second server, and sends the target packet to the second server, so that the second server responds to the target a message, and generating a response message of the target message;

Receiving, by the access device, the response packet returned by the second server, where a source IP address of the response packet is an IP address of the second server;

Receiving, by the access device, the page obtaining request, and forwarding the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response of the page obtaining request;

The access device receives the page response returned by the second server.

In conjunction with the first possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the access device receives a page acquisition request sent by the client, and processes the page acquisition request Previously, the method further includes:

The access device performs a secure socket layer SSL negotiation with the client to determine a key for communication with the client;

Correspondingly, the access device receives the page acquisition request sent by the client, processes the page acquisition request, and returns a page response to the page acquisition request to the client, including:

The access device receives an HTTP GET request sent by the client and encrypted by the key, and performs decryption processing on the HTTP GET request according to the key;

Responding to the HTTP GET request after the decryption process, the access device obtains a page response of the page acquisition request, and performs encryption processing on the page response according to the key;

The access device returns the page response encrypted with the key to the client, so that the client communicates with the first server according to the URL of the first server.

With reference to the first aspect, or the first possible implementation of the first aspect, or the second possible implementation of the first aspect, or the third possible implementation of the first aspect, in the first aspect Of the four possible implementations,

The access device receives the target packet sent by the client, obtains the destination IP address of the target packet, and saves the information, including:

Receiving, by the access device, a target packet sent by the client, acquiring a source IP address, a source port number, and a destination IP address of the target packet;

The access device uses the source IP address and the source port number of the target packet as key values, and creates a data table by using the destination IP address of the target packet as a result value;

Correspondingly, the access device replaces the source IP address of the response packet with the saved destination IP address of the target packet, and sends the response packet to the client, including:

The access device uses the destination IP address and the destination port number of the response packet as key values to search for a data table corresponding to the key value;

The access device obtains the IP address as the result value from the searched data table, and uses the IP address as the source IP address of the response packet to send the response packet to the client.

A second aspect provides a message response apparatus, where the apparatus is disposed in an access device, and includes:

a storage module, configured to receive a target packet sent by the client, obtain the destination IP address of the target packet, and save the destination IP address, the source port number, and the destination IP address;

a packet processing module, configured to process the target packet, to obtain a response packet of the target packet, where a destination IP address and a destination port number of the response packet are source IP addresses of the target packet Source port number;

a message sending module, configured to replace the source IP address of the response packet with the destination IP address of the saved target packet, and send the response packet to the client;

a response module, configured to receive a page acquisition request sent by the client, process the page acquisition request, and return a page response to the page acquisition request to the client, where the page response includes a first server URL.

In conjunction with the second aspect, in a first possible implementation of the second aspect,

The packet processing module is specifically configured to:

And replacing the destination IP address of the target packet with the IP address of the access device, and responding to the target packet to obtain a response packet of the target packet, where the source IP address of the response packet is IP address of the access device;

The response module is specifically configured to:

Receiving a page acquisition request sent by the client, responding to the page acquisition request, obtaining a page response of the page acquisition request, and returning the page response to the client.

In conjunction with the second aspect, in a second possible implementation of the second aspect,

The packet processing module includes:

An IP obtaining unit, configured to acquire an IP address of the second server;

a first sending unit, configured to replace a destination IP address of the target packet with an IP address of the second server, and send the target packet to the second server, so that the second server responds to the Decoding a target message, and generating a response message of the target message;

a first receiving unit, configured to receive the response packet returned by the second server, where a source IP address of the response packet is an IP address of the second server;

The response module includes:

a request processing unit, configured to receive the page obtaining request, and forward the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response request of the page obtaining request;

The response processing unit is configured to receive the page response returned by the second server, and return the page response to the client.

In conjunction with the first possible implementation of the second aspect, in a third possible implementation of the second aspect, the device further includes:

An SSL negotiation module, configured to perform SSL negotiation with the client to determine a key for communicating with the client;

The response module includes:

a second receiving unit, configured to receive an HTTP GET request sent by the client and encrypted by the key, and perform decryption processing on the HTTP GET request according to the key;

The response obtaining unit is configured to obtain a page response of the page obtaining request in response to the decrypted HTTP GET request, and perform encryption processing on the page response according to the key;

a second sending unit, configured to return, to the client, the page response encrypted by the key, so that the client communicates with the first server according to a URL of the first server.

With reference to the second aspect, or the first possible implementation of the second aspect, or the second possible implementation of the second aspect, or the third possible implementation of the second aspect, in the second aspect Of the four possible implementations,

The storage module includes:

An IP obtaining unit, configured to receive a target packet sent by the client, and obtain a source IP address, a source port number, and a destination IP address of the target packet;

a creating unit, configured to use a source IP address and a source port number of the target packet as a key value, and create a data table by using a destination IP address of the target packet as a result value;

The message sending module includes:

a searching unit, configured to use a destination IP address and a destination port number of the response packet as key values to search for a data table corresponding to the key value;

An IP conversion unit, configured to obtain an IP address as a result value from a data table searched by the searching unit, and send the IP address as a source IP address of the response packet to the client Response message.

Compared with the prior art, the embodiment of the invention has the following beneficial effects:

In the embodiment of the present invention, when receiving the target packet sent by the client, the destination IP address of the target packet is obtained and saved, and the response packet of the target packet is obtained, by using the saved target packet. The destination IP address is replaced with the source IP address of the response packet, and the response packet is sent to the client after the IP address is translated. When receiving the page acquisition request sent by the client according to the response packet, the destination IP address may be The client returns a page response including the first server URL, so that the client can access the page corresponding to the URL.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings to be used in the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

FIG. 1 is a schematic flowchart of a message response method according to an embodiment of the present disclosure;

FIG. 2 is a schematic diagram of interaction of a message response method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of interaction of another packet response method according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a message response apparatus according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of another message response apparatus according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of still another message response apparatus according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of an access device according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a message response method according to an embodiment of the present invention, including:

S101: The access device receives the target packet sent by the client, obtains the destination IP address of the target packet, and saves the destination IP address.

In a specific embodiment, the client inputs a Uniform Resource Locator (URL) of the website to be accessed by the browser, and sends a DNS request to the Domain Name System (DNS) server corresponding to the website. And receiving the IP address of the website returned by the DNS server in response to the DNS request. Optionally, the access device proxy may also respond to the DNS request and return the IP address of the website, which is not limited by the embodiment of the present invention.

The access device in the embodiment of the present invention may be a device such as a switch or a router.

After obtaining the IP address of the website, that is, the destination IP address, the client sends the target packet. The access device receives the target packet sent by the client. The target packet includes a source IP address, a source port number, and the destination IP address.

It should be noted that the target message is a Hypertext Transfer Protocol (HTTP) message, a Hypertext Transfer Protocol Secure (HTTPS) message, or other application layer protocol message, such as User Datagram Protocol (UDP) packet when the DNS packet is redirected. Specifically, when the access device receives the packet sent by the client, the port number of the transmission control protocol (TCP) of the packet is 80 (HTTP packet) and 443 (HTTPS packet). If the port number of the UDP destination port is 53 (DNS packet), the received packet can be used as the destination packet.

S102: The access device processes the target packet to obtain a response packet of the target packet.

The destination IP address and the destination port number of the response packet are the source IP address and the source port number of the target packet.

S103: The access device replaces the source IP address of the response packet with the destination IP address of the saved target packet, and sends the response packet to the client.

Optionally, the access device may save the destination IP address of the target packet by creating a data table, where the data table includes a correspondence between a key value (KEY) and a result value (VALUE); the data table may be a Greek HASH table. The access device receives the target packet sent by the client, and obtains the destination IP address of the target packet and saves the packet, where the access device receives the target packet sent by the client, and obtains the target. The source IP address, the source port number, and the destination IP address of the packet; the source IP address and the source port number of the target packet are used as KEYs, and the destination IP address of the target packet is stored as the VALUE as the VALUE. In the table. Further, the access device replaces the source IP address of the response packet with the destination IP address of the saved target packet, and sends the response packet to the client, which may be specifically: The ingress device uses the destination IP address and the destination port number of the response packet as a KEY to search for a data table corresponding to the KEY; obtains an IP address as a VALUE from the found data table, and uses the IP address as a Sending the response packet to the client by using a source IP address of the response packet.

Further, after the receiving the target packet sent by the client, and before acquiring the destination IP address of the target packet, the access device may further detect whether the destination IP address of the target packet is the first The IP address of a server; if not the IP address of the first server, the target message is The destination IP address is stored. Otherwise, the packet is forwarded and forwarded without being picked up.

S104: The access device receives a page acquisition request sent by the client, processes the page acquisition request, and returns a page response to the page acquisition request to the client.

The page response includes a URL of the first server.

Optionally, the first server may be a server associated with the access device, where the first server includes a webpage web server, a video server, a game server, and the like, which are not limited in the embodiment of the present invention. In a specific embodiment, the access device processes the target packet to obtain the response packet of the target packet, which may be specifically: the access device replaces the IP address of the access device with the The destination IP address of the target packet is obtained by the destination IP address of the target packet, and the source IP address of the response packet is the IP address of the access device. Further, the access device is pre-configured with the URL address of the first server to generate a page response including the first server URL in response to the request when receiving the page acquisition request sent by the client. That is, the access device receives the page obtaining request sent by the client, and the processing of the page obtaining request may be: the access device receives a page obtaining request sent by the client, and responds to the page obtaining request. Get the page response of the page get request.

In an embodiment, if the received packet is an HTTPS packet, the access device is further configured to receive an HTTP GET request, that is, a page acquisition request sent by the client according to the response packet, and before processing the page acquisition request. The client needs to negotiate with a Secure Sockets Layer (SSL) and determine a key for communication with the client. Specifically, the access device receives the page obtaining request sent by the client, processes the page obtaining request, and returns a page response to the page obtaining request to the client, which may be specifically: The ingress device receives an HTTP GET request sent by the client and encrypted by the key, and decrypts the HTTP GET request according to the key; the access device responds to the decrypted HTTP GET request, Obtaining a page response of the page obtaining request, and performing encryption processing on the page response according to the key; the access device returns, to the client, the page response encrypted by the key, so that The client communicates with the first server according to the URL of the first server.

Optionally, the second server, that is, the redirecting server, may be configured to perform redirection processing on the HTTP packet and the HTTPS packet sent by the client, where the first server may be The second server is associated, and the URL address of the first server is configured in the second server. The access device processes the target packet to obtain a response packet of the target packet The access device may obtain the IP address of the second server; the access device replaces the destination IP address of the target packet with the IP address of the second server, and sends the second IP address to the second server. Sending, by the server, the target packet, so that the second server responds to the target packet, and generates a response packet of the target packet; and the access device receives the response returned by the second server The source IP address of the response packet is the IP address of the second server. Correspondingly, the access device receives the page obtaining request sent by the client, and the processing of the page obtaining request may be: the access device receives the page obtaining request, and forwards the request to the second server. The page obtains a request, so that the second server responds to the page obtaining request to obtain a page response of the page obtaining request; and the access device receives the page response returned by the second server.

When the embodiment of the present invention receives the target packet sent by the client, the destination IP address of the target packet is obtained and saved, and the response packet of the target packet is obtained, and the saved target packet is saved. The destination IP address is replaced with the source IP address of the response packet, and the response packet is sent to the client after the IP address is translated. When the client receives the page acquisition request sent by the response packet, A page response including the first server URL is returned to the client, so that the client can access the page corresponding to the URL.

FIG. 2 is a schematic diagram of interaction of a message response method according to an embodiment of the present invention. The method may include:

S201: Send a TCP SYN packet.

In a specific embodiment, the client inputs the URL of the website to be accessed through the browser, sends a DNS request to the corresponding DNS server of the website, and receives the IP address of the website returned by the DNS server in response to the DNS request. Optionally, the access device proxy may also respond to the DNS request and return the IP address of the website, which is not limited by the embodiment of the present invention.

After obtaining the IP address of the website, the client sends a TCP SYN (synchronize) message, that is, the target message, and wants to establish a TCP connection with the remote website. The destination IP address of the TCP SYN packet is the IP address of the website, and the source IP address and the source port number are the IP address and port number corresponding to the client.

S202: The source IP address and the source port number of the TCP SYN packet are used as key values, and the destination IP address of the TCP SYN packet is used as the result value to create a HASH table.

In a specific embodiment, after receiving the TCP SYN packet, the access device uses the source IP address and the source port number of the packet as the key value KEY, and the destination IP address as the result value VALUE. The HASH table is created to store the destination IP address of the packet, so that the destination IP address can be obtained during subsequent IP conversion.

Further, after receiving the packet sent by the client, and before creating the HASH table, the access device may also detect whether the destination IP address of the packet is an IP address of the first server that is a pre-configured web server; If not, the access device may create a HASH table according to the source IP address and the destination IP address of the packet; if yes, the access device forwards the packet and does not perform the pickup.

Further, after receiving the packet sent by the client, and before creating the HASH table, the access device may further determine whether the packet is a TCP SYN packet; if the TCP SYN packet is the The access device can create a HASH table according to the source IP address, port number, and destination IP address of the TCP SYN packet.

S203: Replace the destination IP address of the TCP SYN packet with the IP address of the access device, and generate a TCP SYN ACK packet in response to the TCP SYN packet.

Further, the access device uses the IP address of the access device as the destination IP address of the TCP SYN packet, and recalculates the checksum of the TCP packet header and the IP packet header in the TCP SYN packet. The access device generates a TCP SYN ACK packet in response to the TCP SYN packet.

S204: The destination IP address and the destination port number of the TCP SYN ACK packet are used as key values, and the HASH table corresponding to the key value is searched, and the IP address as the result value is obtained from the found HASH table, and the IP address is obtained. The address is the source IP address of the TCP SYN ACK packet.

S205: Return a TCP SYN ACK message.

The access device searches for the HASH table according to the destination IP address and the destination port number of the TCP SYN ACK packet, and the IP address and the port number of the client are used as the KEY. The destination IP address of the TCP SYN packet is the VALUE corresponding to the KEY. And the IP address corresponding to the VALUE is used as the source IP address of the TCP SYN ACK packet, and the checksum of the TCP header and the IP header in the TCP SYN ACK packet is recalculated and sent to the client, thereby implementing the IP address. Conversion.

It should be noted that, in the process of the redirection, that is, the response of the packet, the destination port number of the HTTP packet, the HTTPS packet, the DNS packet, etc., that is, the destination port number of the TCP is 80, 443 or UDP. For the packet of 53, the access device can perform IP address translation through the HASH table and reply to the client packet.

S206: Send a TCP ACK packet.

S207: The access device performs SSL negotiation with the client, and determines a key for communication between the access device and the client.

In the specific embodiment, during the SSL negotiation process between the access device and the client, the access device negotiates a certificate with the client to determine a key for communication between the access device and the client.

S208: Send an HTTP GET request.

S209: Perform SSL processing on the HTTP GET request to generate a TCP FIN packet, where the TCP FIN packet includes a URL of the web server.

In the specific embodiment, after the access device performs SSL negotiation with the client, the client encrypts the HTTPS GET request, that is, the page acquisition request, according to the key determined by the SSL negotiation, and sends the encrypted HTTPS GET request packet to the access. device.

S210: Return a TCP FIN message.

After receiving the encrypted HTTPS GET request packet, the access device decrypts the HTTPS GET request packet according to the key determined by the SSL negotiation, thereby obtaining the plaintext data, and generating a redirect in response to the HTTPS GET request. The TCP FIN packet is a page response. The TCP FIN packet may be an HTTP 301 response packet or an HTTP 302 response packet. The TCP FIN packet includes a pre-configured web server, that is, a URL of the first server, so that the client The terminal communicates with the web server according to the URL. At the same time, the TCP tag location is FIN, and the link between the client and the access device is closed. Specifically, before returning the TCP FIN to the client, the access device may further encrypt the TCP FIN packet by using the negotiated key, and the client receives the TCP FIN packet according to the negotiated key. The TCP FIN message is decrypted to obtain plaintext data.

S211: Send a TCP ACK packet.

S212: Send a TCP FIN message.

S213: Return a TCP ACK packet.

In the specific embodiment, after receiving the TCP FIN message returned by the access device, the client replies with the ACK and the FIN message, and the access device responds to the ACK and FIN message and replies with the ACK message.

Further, the HASH table may further include connection state information of the access device and the client, and may update the device when receiving the packet sent by the client or sending the packet to the client. Determining the connection status information of the access device and the client recorded in the HASH table, to the HASH The table is managed. For example, the connection status information may include an initial status Initial, a redirect status Redirect, a FIN message receiving status FIN Received, a FIN message sending status FIN Sent, a connection closed status closed, and the like. For example, the created HASH table can be as shown in Table 1.

Table I

Specifically, the access device may record the connection state information of the access device and the client as Initial when receiving the TCP SYN packet sent by the client, and update the connection state information when the access device sends the redirect message. For the Redirect, when receiving the TCP FIN packet sent by the client, the connection status information is updated to FIN_Received, and the connection status information is updated to Closed when the FIN message sent by the client responds with a TCP ACK message. If the access device detects that the connection status information recorded in the HASH table is closed, it can determine that the connection status between the access device and the client is off, and the HASH table can be deleted.

It should be noted that, under normal circumstances, when a HASH connection entry is in the Closed state, the HASH table can be deleted and the resources are released. However, in some abnormal situations, such as the physical link loss, the HASH connection entry is not deleted normally. You can use the new HASH table to overwrite the old HASH table to delete the old HASH table. Specifically, the number of entries allowed for each HASH table may be preset. For example, the total length of the HASH table is 512 (ie, the range of the HASH table index). If the conflict is set to 4 times, the HASH table has a total of 512*4. specification. Whenever a new connection request is established, if it is calculated that the index of the HASH table already has 4 connections, the oldest connection is overwritten with the new connection.

S214: Send a TCP SYN packet.

S215: Return a TCP SYN ACK message.

S216: Send a TCP ACK packet.

The client initiates a TCP connection with the web server, redirects to the web server according to the URL, communicates with the web server, and the web server pushes the page to the client. For example, the web server is a portal server, and after the client initiates a TCP connection with the portal server, the portal server can push the authentication page to the client.

It should be noted that, for the IP packet that reaches the specified web server, the access device does not perform the above redirection process, and directly forwards the IP packet to the web server.

When the embodiment of the present invention receives the TCP SYN packet, that is, the target packet, the HASH table is created according to the source IP address and the source port number of the SYN packet, so as to store the destination IP address of the packet. And the IP address of the access device is used as the destination IP address of the target packet, and the response packet is generated in response to the target packet, and then the destination IP address that is found in the HASH table is used as the source of the response packet. The IP address is sent to the client after the IP address is translated, and the HTTP GET request sent by the client according to the response message is sent to the client, and the HTTP GET request is processed by SSL. The client replies to the URL of the pre-configured web server, so that the HTTPS message is redirected, so that the client can access the webpage corresponding to the URL.

FIG. 3 is a schematic diagram of interaction of another packet response method according to an embodiment of the present invention. The method may include:

S301: Send a TCP SYN packet.

In a specific embodiment, the client inputs the URL of the website to be accessed through the browser, sends a DNS request to the corresponding DNS server of the website, obtains the IP address of the website, and sends a TCP SYN message to the access device, that is, the target report. Text.

S302: The source IP address and the source port number of the TCP SYN packet are used as key values, and the destination IP address of the TCP SYN packet is used as the result value to create a HASH table.

In a specific embodiment, after receiving the TCP SYN packet, the access device uses the source IP address and the source port number of the packet as the key value KEY, and the destination IP address as the result value VALUE, creates a HASH table, and stores the report. The destination IP address of the text is used to obtain the destination IP address for subsequent IP conversion.

S303: Replace the destination IP address of the TCP SYN packet with the IP address of the redirecting server, and send a TCP SYN packet.

Optionally, the redirecting server, that is, the second server, configured to redirect the HTTP packets, the HTTPS packets, the DNS packets, and the like sent by the client, may be deployed in the system, so that the redirecting The web server stored in the server, that is, the URL of the first server can be flexibly configured.

Specifically, the access device creates a HASH table, that is, stores the destination IP address of the TCP SYN packet. After that, the IP address of the redirect server is used as the destination IP address of the TCP SYN packet, and the checksum of the TCP header and the IP header in the TCP SYN packet is recalculated, and the TCP SYN packet is sent to the redirect. The server performs packet processing by the redirect server.

S304: Respond to the target packet, and generate a TCP SYN ACK packet.

S305: Return a TCP SYN ACK message.

In a specific embodiment, after receiving the TCP SYN packet sent by the access device, the redirecting server responds to the packet and generates a TCP SYN ACK packet, and returns the TCP SYN ACK packet to the access device. The destination IP address and destination port number of the TCP SYN ACK packet are the IP address and port number corresponding to the client.

S306: Find the IP address as the result value from the HASH table, and use the found IP address as the source IP address of the TCP SYN ACK packet.

S307: Return a TCP SYN ACK message.

In a specific embodiment, the access device receives the TCP SYN ACK packet, which is a response packet, and responds to the destination IP address and destination port number of the TCP SYN ACK packet, that is, the IP address and port number of the client are used as KEY, find the HASH table, obtain the destination IP address of the TCP SYN packet, that is, the VALUE corresponding to the KEY, and use the IP address corresponding to the VALUE as the source IP address of the TCP SYN ACK packet, and recalculate the TCP SYN. The checksum of the TCP header and the IP header in the ACK packet is sent to the client, thereby implementing IP address translation.

It should be noted that, in the redirection process, the packets of the HTTP port, the HTTPS packet, the DNS packet, and the like, that is, the TCP destination port number is 80, 443, or the UDP destination port number is 53. The access device can replace the destination IP address of the received packet with the IP address of the redirecting server, and forward the packet to the redirecting server. The responding server responds to the packet after responding. Sending to the access device, the access device performs IP address translation according to the HASH table, and sends the response packet to the source IP address of the response packet. The client will not go into details later.

S308: Send a TCP ACK packet.

S309: Send a TCP ACK packet.

S310: Send an HTTP GET request.

S311: Send an HTTP GET request.

S312: Generate a TCP FIN message in response to the HTTP GET request, where the TCP FIN message includes a URL of the web server.

Optionally, before the client sends the HTTP GET request, that is, the page acquisition request, the redirect server may further perform SSL negotiation with the client to determine a key for communication between the redirect server and the client. Further, the client may encrypt the HTTPS GET request according to the key determined by the SSL negotiation, and send the encrypted HTTP GET request to the redirect server through the access device.

Further, after receiving the encrypted HTTPS GET request packet, the redirecting server decrypts the HTTPS GET request packet according to the key determined by the SSL negotiation, thereby obtaining the plaintext data, and responding to the HTTPS GET request. The TCP FIN message is generated by the redirection packet. The TCP FIN packet may be an HTTP 301 response packet or an HTTP 302 response packet. The TCP FIN packet includes a pre-configured URL of the web server to enable the client. Communicate with the web server based on the URL.

It should be noted that the URL of the web server in the redirect server can be flexibly configured according to user requirements.

S313: Return a TCP FIN message.

S314: Return a TCP FIN message.

S315: Send a TCP ACK packet.

S316: Send a TCP ACK packet.

S317: Send a TCP FIN message.

S318: Send a TCP FIN message.

S319: Return a TCP ACK message.

S320: Return a TCP ACK packet.

In a specific embodiment, after receiving the TCP FIN message returned by the access device, the client replies with an ACK and a FIN message. After receiving the TCP FIN packet sent by the client, the access device can replace the destination IP address of the TCP FIN packet with the IP address of the redirect server and forward it to the redirect server. The redirecting server responds to the TCP FIN packet and replies with an ACK, and returns the replied TCP ACK packet to the access device, and the access device replies to the TCP ACK packet to the client.

S321: Send a TCP SYN packet.

S322: Return a TCP SYN ACK message.

S323: Send a TCP ACK packet.

In a specific embodiment, after receiving the redirect message including the URL of the web server returned by the access device, the client may initiate a TCP connection with the web server, and redirect to the web server according to the URL, and the web The server communicates.

The embodiment of the present invention implements the redirection of the packets such as the HTTP packet and the HTTPS packet by deploying the redirecting server, that is, the second server, so that the redirected server can be redirected to the web server. The URL is flexibly configured. At the same time, the deployment of the redirect server also reduces the load on the access device to a certain extent. It can effectively redirect packets such as HTTP packets and HTTPS packets, so that the client can access the URL. The web page corresponding to the URL.

FIG. 4 is a schematic structural diagram of a message response apparatus according to an embodiment of the present invention. The apparatus may include a storage module 11, a message processing module 12, a message sending module 13, and a response module 14.

The device in the embodiment of the present invention may be specifically configured in an access device such as a switch or a router.

The storage module 11 is configured to receive a target packet sent by the client, obtain a destination IP address of the target packet, and save the destination IP address.

The target packet includes a source IP address, a source port number, and the destination IP address.

In a specific embodiment, the client inputs the URL of the website that is to be accessed through the browser, obtains the IP address of the website, sends a DNS request to the corresponding DNS server of the website, and receives the DNS server returns in response to the DNS request. The IP address of the website. Optionally, the access device proxy may also respond to the DNS request and return the IP address of the website, which is not limited by the embodiment of the present invention.

After obtaining the IP address of the website, that is, the destination IP address, the client sends the target packet. The storage module 11 receives the target packet sent by the client, and saves the destination IP address of the target packet.

It should be noted that the target packet is an HTTP packet, an HTTPS packet, or another application layer protocol packet, such as a UDP packet when the DNS packet is redirected. Specifically, the access device receives the packet sent by the client, and if the TCP port number of the packet is 80 (HTTP packet), 443 (HTTPS packet), or UDP destination port number is 53 ( The received packet is used as the destination packet.

The message processing module 12 is configured to process the target packet to obtain the response of the target packet Should be a message.

Optionally, the message processing module 12 may save the destination IP address of the target packet by creating a data table, where the data table includes a correspondence between a key value (KEY) and a result value (VALUE), such as The source IP address and the source port number of the target packet are used as the KEY, and the destination IP address of the target packet is stored in the data table as a VALUE. The data table can be a hash HASH table.

The message sending module 13 is configured to replace the source IP address of the response packet with the saved destination IP address of the target packet, and send the response packet to the client.

In a specific embodiment, after the message processing module 12 responds to the received target message and obtains the response message, the message sending module 13 can also use the destination IP address of the saved target message as the response message. Source IP address, and send the response message to the client.

The response module 14 is configured to receive a page acquisition request sent by the client, process the page acquisition request, and return a page response to the page acquisition request to the client, where the page response includes The URL of a server.

Optionally, the first server may be a server associated with the access device, where the first server includes a webpage web server, a video server, a game server, and the like, which are not limited in the embodiment of the present invention. The URL address of the first server is pre-configured in the access device.

Further, after receiving the page acquisition request sent by the client according to the response message, such as an HTTP GET request, the response module 14 may perform a redirect process on the HTTP GET request to obtain a page response, and return a redirect to the client. The URL to the web server.

FIG. 5 is a schematic structural diagram of another packet response apparatus according to an embodiment of the present invention. The packet processing module 12 may be specifically configured to:

Replacing the destination IP address of the target packet with the IP address of the access device, responding to the target Receiving a response packet of the target packet, the source IP address of the response packet being an IP address of the access device;

The response module 14 can be specifically configured to:

Further, the device may further include:

The SSL negotiation module 15 is configured to perform SSL negotiation with the client to determine a key for communication with the client.

The response module 14 can further include:

The second receiving unit 141 is configured to receive an HTTP GET request sent by the client and encrypted by the key, and perform decryption processing on the HTTP GET request according to the key;

The response obtaining unit 142 is configured to obtain a page response of the page obtaining request in response to the HTTP GET request after the decryption process, and perform encryption processing on the page response according to the key;

The second sending unit 143 is configured to return, to the client, the page response encrypted by the key, so that the client communicates with the first server according to the URL of the first server.

In the specific embodiment, if the received packet is an HTTPS packet, the SSL negotiation module 15 may perform SSL negotiation with the client, negotiate the certificate with the client, and determine the access device and the The key for communication between clients. Specifically, when performing the redirection process, the second receiving unit 141 may receive an HTTP GET request sent by the client and encrypted by the SSL negotiation key, and perform SSL processing on the HTTP GET request to decrypt the plaintext data. The response obtaining unit 142 can respond to the HTTP GET request, generate a redirect message, that is, a page response, and encrypt the redirect message with the key, and then reply the redirect message to the client by using the second sending unit 143. Ending, so that the client communicates with the web server according to the URL of the web server, and redirects the client request to the web server.

After the access device receives the target packet sent by the client, the access device stores the destination IP address of the packet, and uses the IP address of the access device as the destination IP address of the target packet. And generating a response packet in response to the target packet, and then using the stored destination IP address as the source IP address of the response packet, performing IP address translation, and sending the response packet to the client; SSL negotiation, receiving an SSL-negoed HTTP GET request sent by the client according to the response packet, and performing SSL on the HTTP GET request After the processing, the URL of the pre-configured web server is returned to the client, so that the HTTPS packet is redirected, so that the client can access the webpage corresponding to the URL.

FIG. 6 is a schematic structural diagram of another packet response apparatus according to an embodiment of the present invention. The packet processing module 12 may further include:

The IP obtaining unit 121 is configured to acquire an IP address of the second server.

The first sending unit 122 is configured to replace the destination IP address of the target packet with an IP address of the second server, and send the target packet to the second server, so that the second server responds Decoding a target packet, and generating a response packet of the target packet;

The first receiving unit 123 is configured to receive the response packet returned by the second server, where a source IP address of the response packet is an IP address of the second server.

Optionally, the redirecting server, that is, the second server, configured to redirect the HTTP packets and the HTTPS packets sent by the client, may be deployed in the system. The second server is associated, and the URL address of the first server is configured in the second server, so that the URL of the web server stored in the second server can be flexibly configured.

Specifically, after the storage module 11 stores the destination IP address of the target packet, the IP address of the second server is obtained by the IP obtaining unit 121, and the first sending unit 122 uses the IP address of the second server as the target packet. After the destination IP address is recalculated, and the checksum of the TCP packet header and the IP header in the target packet is recalculated, the target packet is sent to the second server, and the second server performs packet processing and generates the target packet. The response message of the text. The first receiving unit 123 receives the response message returned by the second server.

Further, in the embodiment of the present invention, the response module 14 may include:

The request processing unit 144 is configured to receive the page obtaining request, and forward the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response of the page obtaining request. ;

The response processing unit 145 is configured to receive the page response returned by the second server, and return the page response to the client.

Optionally, before the client sends the page obtaining unit, such as an HTTP GET request, the second server may further perform SSL negotiation with the client to determine a key for communication between the second server and the client. Further, the client may encrypt the HTTP GET request according to the key determined by the SSL negotiation, and send the request to the access device, and the access device may pass the request processing unit 144. The encrypted HTTP GET request is sent to the second server to cause the second server to perform SSL processing on the HTTP GET request and generate a page response containing the URL of the first server, such as the web server, that needs to be redirected. The response processing unit 145 receives the page response returned by the second server.

It should be noted that the URL of the web server in the second server can be flexibly configured according to user requirements.

The embodiment of the present invention implements redirection of packets such as HTTP packets or HTTPS packets by deploying a redirect server, that is, a second server, so that a redirected server can be redirected to the web server. The URL is flexibly configured. At the same time, the deployment of the redirect server also reduces the load on the access device to a certain extent. It can effectively redirect packets such as HTTP packets and HTTPS packets, so that the client can access the URL. The web page corresponding to the URL.

Further, on the basis of FIG. 4 or FIG. 5 or FIG. 6, the storage module 11 may further include:

The IP obtaining unit 111 is configured to receive a target packet sent by the client, and obtain a source IP address, a source port number, and a destination IP address of the target packet.

The creating unit 112 is configured to use the source IP address and the source port number of the target packet as key values, and create a data table by using the destination IP address of the target packet as a result value;

Optionally, the created data table may be specifically a HASH table. Specifically, after receiving the target packet, the IP obtaining unit 111 can obtain the source IP address, the source port number, and the destination IP address of the target packet, and the creating unit 112 uses the source IP address and the source port number of the packet as the source IP address and the source port number of the packet. The key value KEY, the destination IP is used as the result value VALUE, and a HASH table is created to store the destination IP address of the packet, so as to obtain the destination IP address when performing subsequent IP conversion.

The message sending module 13 may further include:

The searching unit 131 is configured to use the destination IP address and the destination port number of the response packet as key values to search for a data table corresponding to the key value.

The IP conversion unit 132 is configured to obtain an IP address as a result value from the data table searched by the searching unit 131, and send the IP address as a source IP address of the response packet to the client. The response message.

Specifically, the searching unit 131 may use the IP address and the port number of the client as the KEY to find the HASH table and obtain the target according to the destination IP address and the destination port number of the response packet. The destination IP address of the packet is the VALUE corresponding to the KEY, and the IP address corresponding to the VALUE is used as the source IP address of the response packet by the IP conversion unit 132, and the TCP in the response packet is recalculated. The checksum of the packet header and the IP header is sent to the client to implement IP address translation.

In the embodiment of the present invention, when receiving the target packet sent by the client, the HASH table is created according to the source IP address and the source port number of the target packet, and the destination IP address of the packet is stored and processed. The target packet is used to obtain the response packet of the target packet, and then the destination IP address that is found in the HASH table is used as the source IP address of the response packet, and the IP address is translated and sent to the client. Responding to the packet, so that when the client receives the request for the page according to the response message, the client sends a URL of the first server to the client, so as to redirect the packet such as the HTTP or HTTPS packet. So that the client can access the web page corresponding to the URL.

Further, please refer to FIG. 7, which is a schematic structural diagram of an access device according to an embodiment of the present invention. The access device according to the embodiment of the present invention includes: a communication port 300, a memory 200, and a processor 100, and the communication port 300. The data connection between the memory 200 and the processor 100 may be performed through a bus, or may be connected by other means. In the present embodiment, a bus connection will be described.

The memory 200 may be a random access memory (RAM) or a non-volatile memory, such as at least one disk storage.

A program is stored in the memory 200. In particular, the program can include program code, the program code including computer operating instructions.

The processor 100 executes the program stored in the memory 200 to implement the message response method shown in FIG. 1 of the present invention, including:

Receiving, by the communication port 300, the target packet sent by the client, and acquiring the destination Internet Protocol IP address of the target packet, where the target packet includes a source IP address, a source port number, and the destination IP address. ;

Processing the target packet to obtain the response packet of the target packet, where the destination IP address and the destination port number of the response packet are the source IP address and the source port number of the target packet;

And replacing the source IP address of the response packet with the saved destination IP address of the target packet, and sending the response packet to the client by using the communication port 300;

Receiving, by the communication port 300, a page acquisition request sent by the client, processing the page acquisition request, and returning, by the communication port 300, a page response to the page acquisition request to the client, the page The response includes the Uniform Resource Locator URL of the first server.

Optionally, the processing the target packet to obtain the response packet of the target packet includes:

And replacing the destination IP address of the target packet with the IP address of the access device, and responding to the target packet to obtain a response packet of the target packet, where the source IP address of the response packet is the access IP address of the device;

Correspondingly, the receiving the page obtaining request sent by the client, and processing the page obtaining request, specifically includes:

Receiving, by the communication port 300, a page acquisition request sent by the client, and responding to the page acquisition request, obtaining a page response of the page acquisition request.

Obtain the IP address of the second server;

Replacing the destination IP address of the target packet with the IP address of the second server, and sending the target packet to the second server, so that the second server responds to the target packet and generates a response message of the target message;

Receiving, by the second server, the response packet, where the source IP address of the response packet is an IP address of the second server;

Receiving, by the communication port 300, the page obtaining request, and forwarding the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response of the page obtaining request;

Receiving, by the communication port 300, the page response returned by the second server.

Optionally, before the receiving the page obtaining request sent by the client, and processing the page obtaining request, the method may further include:

Performing a secure socket layer SSL negotiation with the client to determine a key for communication with the client;

Correspondingly, the receiving the page obtaining request sent by the client, processing the page obtaining request, and returning the page response to the page obtaining request to the client, specifically:

Receiving, by the communication port 300, an HTTP GET request sent by the client and encrypted by the key, and performing decryption processing on the HTTP GET request according to the key;

Responding to the HTTP GET request after the decryption process, obtaining a page response of the page acquisition request, and performing encryption processing on the page response according to the key;

The page response encrypted with the key is returned to the client via the communication port 300 to cause the client to communicate with the first server according to the URL of the first server.

Optionally, the receiving the target packet sent by the client, acquiring the destination IP address of the target packet, and saving, specifically:

Receiving, by the communication port 300, a target packet sent by the client, acquiring a source IP address, a source port number, and a destination IP address of the target packet;

The source IP address and the source port number of the target packet are used as key values, and the destination IP address of the target packet is used as a result value to create a data table.

The memory 200 can also be used to store the data table.

Correspondingly, the source IP address of the response packet is replaced by the destination IP address of the saved target packet, and the response packet is sent to the client, which specifically includes:

Using the destination IP address and the destination port number of the response packet as key values, searching for a data table corresponding to the key value;

The IP address as the result value is obtained from the searched data table, and the IP address is used as the source IP address of the response packet, and the response packet is sent to the client through the communication port 300.

The processor 100 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP processor, etc.), or a digital signal processor (DSP), an application specific integrated circuit. (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.

In the above embodiments, the descriptions of the various embodiments are different, and the details that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and may be additionally implemented in actual implementation. Sub-systems, such as multiple units or components, may be combined or integrated into another system, or some features may be omitted or not implemented. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The above software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present invention. Part of the steps. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

A person skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of each functional module described above is exemplified. In practical applications, the above function assignment can be completed by different functional modules as needed, that is, the device is installed. The internal structure is divided into different functional modules to perform all or part of the functions described above. For the specific working process of the device described above, refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

A message response method, comprising:

The access device receives the target packet sent by the client, and obtains the destination Internet Protocol IP address of the target packet, where the destination packet includes the source IP address, the source port number, and the destination IP address.

The access device processes the target packet to obtain a response packet of the target packet, where the destination IP address and the destination port number of the response packet are the source IP address and the source port of the target packet. number;

The access device replaces the source IP address of the response packet with the destination IP address of the saved target packet, and sends the response packet to the client.

Receiving, by the access device, a page acquisition request sent by the client, processing the page acquisition request, and returning a page response to the page acquisition request to the client, where the page response includes the first server Uniform Resource Locator URL.
The method of claim 1 wherein

The access device processes the target packet to obtain the response packet of the target packet, including:

The access device replaces the destination IP address of the target packet with the IP address of the access device, and responds to the target packet to obtain a response packet of the target packet, where the response packet is sent. The IP address is an IP address of the access device;

Correspondingly, the access device receives the page obtaining request sent by the client, and processes the page obtaining request, including:

Receiving, by the access device, a page obtaining request sent by the client, and responding to the page obtaining request, obtaining a page response of the page obtaining request.
The method of claim 1 wherein

The access device processes the target packet to obtain the response packet of the target packet, including:

The access device acquires an IP address of the second server;

The access device replaces the destination IP address of the target packet with the IP address of the second server, and sends the target packet to the second server, so that the second server responds to the target a message, and generating a response message of the target message;

Receiving, by the access device, the response packet returned by the second server, where a source IP address of the response packet is an IP address of the second server;

Correspondingly, the access device receives the page obtaining request sent by the client, and processes the page obtaining request, including:

Receiving, by the access device, the page obtaining request, and forwarding the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response of the page obtaining request;

The access device receives the page response returned by the second server.
The method of claim 2 wherein:

Before the access device receives the page acquisition request sent by the client, and the processing the page acquisition request, the method further includes:

The access device performs a secure socket layer SSL negotiation with the client to determine a key for communication with the client;

Correspondingly, the access device receives the page acquisition request sent by the client, processes the page acquisition request, and returns a page response to the page acquisition request to the client, including:

The access device receives an HTTP GET request sent by the client and encrypted by the key, and performs decryption processing on the HTTP GET request according to the key;

Responding to the HTTP GET request after the decryption process, the access device obtains a page response of the page acquisition request, and performs encryption processing on the page response according to the key;

The access device returns the page response encrypted with the key to the client, so that the client communicates with the first server according to the URL of the first server.
A method according to any one of claims 1 to 4, characterized in that

The access device receives the target packet sent by the client, obtains the destination IP address of the target packet, and saves the information, including:

Receiving, by the access device, a target packet sent by the client, acquiring a source IP address, a source port number, and a destination IP address of the target packet;

The access device uses the source IP address and the source port number of the target packet as key values, and creates a data table by using the destination IP address of the target packet as a result value;

Correspondingly, the access device replaces the source IP address of the response packet with the saved destination IP address of the target packet, and sends the response packet to the client, including:

The access device uses the destination IP address and the destination port number of the response packet as key values to search for a data table corresponding to the key value;

The access device obtains the IP address as the result value from the searched data table, and uses the IP address as the source IP address of the response packet to send the response packet to the client.
A message response device, wherein the device is disposed in an access device, and includes:

a storage module, configured to receive a target packet sent by the client, obtain the destination IP address of the target packet, and save the destination IP address, the source port number, and the destination IP address;

a packet processing module, configured to process the target packet, to obtain a response packet of the target packet, where a destination IP address and a destination port number of the response packet are source IP addresses of the target packet Source port number;

a message sending module, configured to replace the source IP address of the response packet with the destination IP address of the saved target packet, and send the response packet to the client;

a response module, configured to receive a page acquisition request sent by the client, process the page acquisition request, and return a page response to the page acquisition request to the client, where the page response includes a first server URL.
The device of claim 6 wherein:

The packet processing module is specifically configured to:

And replacing the destination IP address of the target packet with the IP address of the access device, and responding to the target packet to obtain a response packet of the target packet, where the source IP address of the response packet is IP address of the access device;

The response module is specifically configured to:

Receiving a page acquisition request sent by the client, responding to the page acquisition request, obtaining a page response of the page acquisition request, and returning the page response to the client.
The device of claim 6 wherein:

The packet processing module includes:

An IP obtaining unit, configured to acquire an IP address of the second server;

a first sending unit, configured to replace a destination IP address of the target packet with an IP address of the second server, and send the target packet to the second server, so that the second server responds to the Decoding a target message, and generating a response message of the target message;

a first receiving unit, configured to receive the response packet returned by the second server, where a source IP address of the response packet is an IP address of the second server;

The response module includes:

a request processing unit, configured to receive the page obtaining request, and forward the page obtaining request to the second server, so that the second server responds to the page obtaining request to obtain a page response request of the page obtaining request;

The response processing unit is configured to receive the page response returned by the second server, and return the page response to the client.
The device according to claim 7, wherein the device further comprises:

An SSL negotiation module, configured to perform SSL negotiation with the client to determine a key for communicating with the client;

The response module includes:

a second receiving unit, configured to receive an HTTP GET request sent by the client and encrypted by the key, and perform decryption processing on the HTTP GET request according to the key;

The response obtaining unit is configured to obtain a page response of the page obtaining request in response to the decrypted HTTP GET request, and perform encryption processing on the page response according to the key;

a second sending unit, configured to return, to the client, the page response encrypted by the key, so that the client communicates with the first server according to a URL of the first server.
A device according to any one of claims 6-9, wherein

The storage module includes:

An IP obtaining unit, configured to receive a target packet sent by the client, and obtain a source IP address, a source port number, and a destination IP address of the target packet;

a creating unit, configured to use a source IP address and a source port number of the target packet as a key value, and create a data table by using a destination IP address of the target packet as a result value;

The message sending module includes:

a searching unit, configured to use a destination IP address and a destination port number of the response packet as key values to search for a data table corresponding to the key value;

An IP conversion unit, configured to obtain an IP address as a result value from a data table searched by the searching unit, and send the IP address as a source IP address of the response packet to the client Response message.